Exposure of client IP addresses in net/http
Priority LOW 38Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 21 fixed, 20 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01517 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial net/http (Go standard library): 1.17.12, 1.18.4Red Hat: 35 advisoriesRed Hat: 21 fixed, 20 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http | before 1.17.12; 1.18.0-0 to before 1.18.4 | 1.17.12, 1.18.4 | Patch available | CNA |
- net/http VendorGo standard library Affected before 1.17.12; 1.18.0-0 to before 1.18.4 Fixed in 1.17.12, 1.18.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.12; 1.18.0 to before 1.18.4 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.12; 1.18.0 to before 1.18.4 Vulnerable ·Go standard library
Remediation
- Fix · CNA net/http (Go standard library) Fixed in 1.17.12, 1.18.4
Red Hat 35 advisories
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
- RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
Show 32 more Red Hat advisories
- RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2023:0407 Released 2023-01-24 · Red Hat rating ModerateOpenShift Virtualization 4.12.0 RPMs security update
- CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
- CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:9047 Released 2022-12-15 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.6 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-hook-runner-rhel8, rhmtc/openshift-migration-legacy-rhel8-operator +14
- RHSA-2022:8626 Released 2022-11-28 · Red Hat rating ModerateOpenShift Container Platform 4.11.17 packages and security update
- Red Hat OpenShift Container Platform 4.11 cri-o-1.24.3-6.rhaos4.11.gitc4567c0.el8, cri-tools-1.24.2-7.el8, ignition-2.14.0-5.rhaos4.11.el8 +1
- RHSA-2022:8250 Released 2022-11-15 · Red Hat rating Moderategrafana-pcp security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-3.2.0-3.el9
- RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Importantgrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
- RHSA-2022:7648 Released 2022-11-08 · Red Hat rating Moderategrafana-pcp security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-3.2.0-2.el8
- RHSA-2022:7529 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:3.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.aarch64::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.ppc64le::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.s390x::container-tools:3.0 +47
- RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
- RHSA-2022:7129 Released 2022-10-25 · Red Hat rating Moderategit-lfs security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) git-lfs-2.13.3-3.el8_6
- RHSA-2022:6430 Released 2022-09-13 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update
- 8Base-OADP-1.0 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-operator-bundle +9
- RHSA-2022:6370 Released 2022-09-06 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
- RHSA-2022:6344 Released 2022-09-06 · Red Hat rating ModerateLogging Subsystem 5.5.1 Security and Bug Fix Update
- RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/log-file-metric-exporter-rhel8 +1
- RHSA-2022:6345 Released 2022-09-06 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.1 security updates and bug fixes
- multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
- RHSA-2022:6347 Released 2022-09-06 · Red Hat rating ModerateVolSync 0.5 security fixes and updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
- RHSA-2022:6348 Released 2022-09-06 · Red Hat rating ModerateGatekeeper Operator v0.2 security and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/gatekeeper-operator-bundle, rhacm2/gatekeeper-rhel8, rhacm2/gatekeeper-rhel8-operator
- RHSA-2022:6183 Released 2022-09-06 · Red Hat rating ModerateLogging Subsystem 5.4.5 Security and Bug Fix Update
- RHOL 5.4 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +5
- RHSA-2022:6346 Released 2022-09-06 · Red Hat rating ModerateRHSA: Submariner 0.13 - security and enhancement update
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/lighthouse-agent-rhel8, rhacm2/lighthouse-coredns-rhel8, rhacm2/nettest-rhel8 +7
- RHSA-2022:6152 Released 2022-09-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:6283 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.2.2 Containers security update
- RHOSSM 2.2 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/pilot-rhel8 +3
- RHSA-2022:6188 Released 2022-08-25 · Red Hat rating ImportantNode Maintenance Operator 4.11.1 security update
- Node Maintenance Operator 4.11 for RHEL 8 workload-availability/node-maintenance-rhel8-operator
- RHSA-2022:6113 Released 2022-08-18 · Red Hat rating ImportantRed Hat Application Interconnect 1.0 Release (rpms)
- Red Hat Service Interconnect 1 skupper-cli-1.0.2-2.el8
- RHSA-2022:6040 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless 1.24.0
- Red Hat OpenShift Serverless 1.24 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +35
- RHSA-2022:6042 Released 2022-08-10 · Red Hat rating ImportantRelease of OpenShift Serverless Client kn 1.24.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.3.1-4.el8
- RHSA-2022:5866 Released 2022-08-02 · Red Hat rating Importantgo-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-1.17.12-1.el7_9, go-toolset-1.17-build-1.17.12-1.el7_9, go-toolset-1.17-golang-1.17.12-1.el7_9 +8
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5775 Released 2022-08-01 · Red Hat rating Importantgo-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.12-1.module+el8.6.0+16014+a372c00b.aarch64::go-toolset:rhel8 +18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library net/http 1.17.12, 1.18.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-01571 Improper sanitization of Transfer-Encoding headers in net/httpPriority LOW 32
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
| 8Base-OADP-1.0 | Fixed | RHSA-2022:6430 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:9047 |
| CNV 4.12 for RHEL 7 | Fixed | RHSA-2023:0407 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0407, RHSA-2023:0408 |
| Node Maintenance Operator 4.11 for RHEL 8 | Fixed | RHSA-2022:6188 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2022:6152 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| RHOL 5.4 for RHEL 8 | Fixed | RHSA-2022:6183 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:6344 |
| RHOSSM 2.2 for RHEL 8 | Fixed | RHSA-2022:6283 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:5866 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5775, RHSA-2022:7129, RHSA-2022:7519, RHSA-2022:7529, RHSA-2022:7648, RHSA-2023:2758, RHSA-2023:2802 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799, RHSA-2022:8057, RHSA-2022:8250, RHSA-2023:2357 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:8626 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398, RHSA-2022:7399 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:6042 |
| Red Hat OpenShift Serverless 1.24 | Fixed | RHSA-2022:6040 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1275 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2022:6113 |
Not affected: 19 products
- 8Base-OADP-1.0
- 8Base-RHMTC-1.7
- CNV 4.12 for RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.11
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Node Maintenance Operator 4.11 for RHEL 8
- OSSO 1.1 for RHEL 8
- OpenShift Custom Metrics Autoscaler 2
- RHOL 5.4 for RHEL 8
- RHOL 5.5 for RHEL 8
- RHOSSM 2.2 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift distributed tracing 2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32148
- 2026-10-03 Alias added: GHSA-f839-v4x8-wvr3
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-32148 · CVE Program
- CVE-2022-32148 · NVD
- FIRST EPSS
- GHSA-f839-v4x8-wvr3 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-32148 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences